ci: migrate golangci-lint to v2

[Iamrushabhshahh]

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

This is the first half of #1463, split as @elliotxx suggested. It moves golangci-lint from v1.56.2 to v2.14.0 and keeps CI on Go 1.22. The Go bump comes in a separate, smaller PR on top of this one.

golangci-lint v1 is no longer maintained and cannot load modules that target Go 1.25, so the Go bump needs v2 first. Details and error lines are in #1462 and #1463.

Changes (two commits):

ci: migrate golangci-lint to v2

• .github/workflows/test.yaml: golangci/golangci-lint-action@v9 with version: v2.14.0. Go stays at 1.22, and the other actions are unchanged.
• .golangci.yml: migrated with golangci-lint migrate, then adjusted by hand to keep the v1 behaviour:
  • same linters. gosimple and stylecheck are now part of staticcheck, gofumpt moves to formatters, and exportloopref (already inactive) is gone.
  • the new staticcheck QF* quick fixes and govet's inline analyser stay off, as v1 did not run them.
  • v1's default exclusions are kept through the comments, common-false-positives, legacy and std-error-handling presets, and the existing exclude texts are kept as rules.
  • skipped directories use (^|/)third_party($|/) as v1 did. The pattern written by the migration did not match files inside them.
  • prealloc is skipped in _test.go files.
• Makefile: GOLINTER_VERSION is v2.14.0 with the v2 module path. make lint and make lint-fix now go through a lint-install target that checks golangci-lint --version. If the binary is missing or a different version, it installs GOLINTER_VERSION. If an older binary still comes first on PATH after that, it stops with a message saying which one, instead of running the wrong linter.

style: fix findings reported by golangci-lint v2

v2's bundled linters report findings that v1 did not, on Go 1.22 as well. All are small:

• govet slog (11): logger.Error(err.Error(), "msg", "error", err) becomes logger.Error("msg", "error", err) in pkg/server/route/route.go and pkg/server/handler/endpoint/endpoint.go. The old calls logged the error as the message and produced a !BADKEY attribute, so this one is a real fix.
• staticcheck SA1006 (15): fmt.Errorf(s) becomes errors.New(s) (secrets providers, watch.go, tferrors.go), and fmt.Printf(s) becomes fmt.Print(s).
• staticcheck S1009 (2): drop x == nil || before len(x) == 0.
• predeclared (4): local max in k8s_printer.go renamed to maxItems.
• prealloc (6): preallocate slices in non-test code.
• gofumpt (1): k8s_printer.go.

No change to go.mod, the Dockerfile or the other workflows.

How I tested it

Locally with Go 1.22.12 (GOTOOLCHAIN=go1.22.12) and golangci-lint v2.14.0:

$ go build ./...      # exit 0
$ go vet ./pkg/...    # exit 0
$ golangci-lint run --max-issues-per-linter=0 --max-same-issues=0 <changed packages>
0 issues.

If I leave out the slog and format-string fixes in route.go, endpoint.go, watch.go and tferrors.go, the same run reports 13 issues, so v2 needs them on Go 1.22 too.

Full repository lint and make cover on my fork's CI, with Go 1.22.12. I added a temporary commit, not part of this PR, so test.yaml runs on push and lint prints every finding: https://github.com/Iamrushabhshahh/kusion/actions/runs/38732820314. Golang Lint passed with 0 issues., and Unit tests with coverage passed.

make lint-install, checked in three cases:

• v2.14.0 already on PATH: nothing is installed, exit 0.
• a v1.56.2 binary earlier on PATH: installs v2.14.0, then stops with <path> is not v2.14.0. Remove it or put $GOPATH/bin first in PATH., exit 2.
• no golangci-lint on PATH: installs v2.14.0, exit 0.

Which issue(s) this PR fixes:

Related: #1462

Special notes for your reviewer:

@elliotxx, this is the lint-only half, on Go 1.22, with the Makefile version check you asked for. Once this is in, I'll send the Go 1.25 bump (CI, Dockerfile, mockey) as its own PR, and that one will close #1462. I'll close #1463 in favour of these two.

Does this PR introduce a user-facing change?

NONE

Additional documentation e.g., design docs, usage docs, etc.:

[Iamrushabhshahh]

Hi @elliotxx, gentle follow-up: this is the lint-only half you asked for, on Go 1.22, with the Makefile version check. All checks are green. Could you take a look when you have time? The Go 1.25 PR is ready to go right after this one.